portkey-admin-mcp 0.12.2 → 0.14.0

package/docs/DISTRIBUTION.md

@@ -1,8 +1,8 @@
 # Distribution and directory inventory
 
-> Last audited: 2026-10-02. Rechecked that day: the Awesome MCP Servers PR, the
-> LobeHub listings, the Docker MCP Catalog PR, and Glama. The other downstream
-> rows below still reflect 2026-09-08.
+> Last audited: 2026-10-16. npm, MCP Registry, LobeHub ownership, the Awesome
+> MCP Servers entry, the Docker submission, and Glama were rechecked. Versions
+> in dated observations describe that check, not a release requirement.
 
 The generated catalog in this repository is the source of truth for tool names,
 counts, and descriptions. Public directory pages can lag a release or retain a
@@ -16,7 +16,7 @@ legacy repository owner, so they should not be used to validate the runtime.
 | [npm](https://www.npmjs.com/package/portkey-admin-mcp) | Canonical package distribution | Automated from a protected release tag using `package.json` |
 | [Official MCP Registry](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.CodesWhat/portkey-admin-mcp) | Canonical MCP metadata under `io.github.CodesWhat/portkey-admin-mcp` | Automated after npm publication using `server.json` |
 | [LobeHub](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp) | Claimed marketplace listing | Run `npm run update:lobehub` after release; `lhm.plugin.json` is owner-declared metadata |
-| [Glama](https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp) | Claimed directory and quality listing. On 2026-10-02 its tool definitions were still at v0.11.5 (last synced 2026-09-08), its description said 150 tools across 18 domains, and its FAQ said 151 tools. The README text it shows says 181 tools across 20 domains | Indexes GitHub; use the listing's **Sync Server** control to pick up 0.12.1, then verify the version and tool count it shows |
+| [Glama](https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp) | Claimed directory and quality listing. On 2026-10-16 the page showed release 0.13.0 and current 184-tool README metadata. Its generated description and FAQ still said 150 and 151 tools; the public inventory API returned 401 | Indexes GitHub; after each release, use **Repository > Sync Server**, then **Dockerfile > Build & Release**, and verify the version and tool count it shows. The generated description and FAQ text are Glama's and refresh on their own schedule |
 | [Awesome MCP Servers](https://github.com/punkpeye/awesome-mcp-servers/pull/13074) | Community list entry; the CodesWhat correction (PR #13074) merged on 2026-09-13 | Update the entry through a new PR when the repository owner, Glama badge, or released catalog count changes |
 
 The canonical description for owner-controlled records is:
@@ -32,7 +32,7 @@ runtime catalog before release.
 
 | Surface | State on 2026-09-08 | Maintenance decision |
 |---|---|---|
-| [LobeHub legacy listing](https://lobehub.com/mcp/scttbnsn-portkey-admin-mcp) | Unpublished on 2026-09-08. On 2026-10-02 the market CLI listed it as `unpublished` at version 0.3.5 and the public page returned 404, while the canonical `codeswhat-portkey-admin-mcp` listing was `published` at 0.12.1 | Nothing to do; only the canonical listing is published |
+| [LobeHub legacy listing](https://lobehub.com/mcp/scttbnsn-portkey-admin-mcp) | Unpublished on 2026-09-08. On 2026-10-16 the authenticated market CLI listed it as `unpublished` at version 0.3.5, while the canonical `codeswhat-portkey-admin-mcp` listing was claimed and `published` at 0.13.0 | Nothing to do; only the canonical listing is published |
 | [PulseMCP](https://www.pulsemcp.com/servers) | A legacy record uses `io.github.s-b-e-n-s-o-n/portkey-admin-mcp` and an old count; listing changes are paused | Recheck when its submission and correction flow reopens; prefer MCP Registry ingestion |
 | [mcp.so](https://mcp.so/servers/portkey-admin-mcp) | Live but stale under the previous owner, with a visible claim control and conflicting counts | Claim and refresh only through its owner workflow; do not automate an undocumented interface |
 | [mcpservers.org](https://mcpservers.org/servers/s-b-e-n-s-o-n/portkey-admin-mcp) | Scrapes the current README but retains the previous owner slug and a 151-tool headline | Use its **Request update** flow, then treat the result as downstream indexing rather than a release gate |
@@ -48,8 +48,9 @@ The [Docker MCP Catalog](https://hub.docker.com/mcp) is curated, has a documente
 pull-request submission path, and matches the repository's existing non-root
 Docker image and stdio support. The submission is
 [docker/mcp-registry#5026](https://github.com/docker/mcp-registry/pull/5026),
-open and awaiting maintainer review as of 2026-10-02, and pinned to the 0.12.0
-release commit. It isn't complete until Docker merges it and the listing is live.
+open and awaiting maintainer review as of 2026-10-16. Its `source.commit` is the
+release pin; refresh that pin, the PR release description, and discovery evidence
+after publication. It is not listed until Docker merges it and the catalog is live.
 
 [Smithery](https://smithery.ai/docs/build/publish) is deferred. Its current
 publishing paths expect a public Streamable HTTP endpoint or an MCPB bundle for a

package/docs/PRISMA_AIRS_INTEROPERABILITY.md

@@ -1,6 +1,6 @@
 # Prisma AIRS interoperability
 
-Last verified: 2026-08-28
+Last verified: 2026-10-16
 
 ## Short answer
 
@@ -12,16 +12,35 @@ Changing `PORTKEY_BASE_URL` to a Prisma AIRS or Strata Cloud Manager URL will no
 
 | Surface | Management interface | Authentication | What this project supports |
 |---|---|---|---|
-| Portkey Admin API | `https://api.portkey.ai/v1` or a compatible self-hosted control plane | `x-portkey-api-key` | Full support through the 20 existing tool domains |
+| Portkey Admin API | `https://api.portkey.ai/v1` or a compatible self-hosted control plane | `x-portkey-api-key` | Support through 22 tool domains |
 | Portkey public model catalog | `https://api.portkey.ai/model-configs/...` | None | `get_model_pricing` |
-| Prisma AIRS AI Gateway | AI Security in Strata Cloud Manager | Prisma AIRS / SCM tenant credentials | No direct admin adapter yet |
+| Prisma AIRS AI Gateway | Published control-plane and admin APIs under `https://api.apps.paloaltonetworks.com/ai_gw` | `Authorization: Bearer` using Prisma AIRS / SCM credentials | Published management contract available; no direct adapter yet |
 | Prisma AIRS security MCP server | Regional Palo Alto Networks `/mcp` endpoint | `x-pan-token`, OAuth, and optional `x-pan-profile` | Works as a separate MCP server; it scans and secures AI interactions rather than managing Portkey resources |
 
-Palo Alto Networks says the Portkey acquisition makes Portkey the core AI Gateway for Prisma AIRS. Its current AI Gateway instructions direct administrators to Strata Cloud Manager, while the documented Prisma AIRS MCP endpoint is for centralized AI-agent security. No public Prisma AIRS admin contract equivalent to Portkey's users, workspaces, prompts, configs, integrations, or keys is documented today. That last sentence is an inference from the currently published product and API documentation, not a promise that such an API will never exist.
-
-The August 2026 Prisma AIRS additions cover runtime, model, skill, discovery, and
-red-team security capabilities. They do not publish a Portkey-compatible AI
-Gateway administration contract, so they do not change this boundary.
+Palo Alto Networks now publishes a Prisma AIRS AI Gateway management OpenAPI,
+linked from Portkey's documentation index alongside the Portkey OpenAPI. It
+includes configs, integrations, API keys, guardrails, MCP servers, rate/usage
+policies, analytics, secret references, and deployments. The earlier August
+assessment that no equivalent public management contract existed is superseded.
+
+The two APIs still differ:
+
+- Prisma AIRS uses Bearer authentication. This server sends `x-portkey-api-key`.
+- Management routes have separate `/ai_gw/v2` and `/ai_gw/admin/v2` bases, with
+  organisation guardrails also published under `/ai_gw/admin/v2/guardrails`.
+- API-key creation is `/api-keys/{sub-type}`, without Portkey's scope segment.
+- The published Prisma specification omits the top-level prompts, prompt
+  partials, collections, labels, users, workspaces, virtual keys, audit logs,
+  and log-export management domains. Some user/workspace subresources remain.
+- The Prisma specification's README says nothing has been verified against the
+  running API; inherited schemas remain unverified and descriptions are mostly
+  empty. Its published version is evidence for adapter design, not verified
+  production parity.
+
+These differences preserve the recommendation to use separate servers today.
+A future adapter must select the right plane per capability, authenticate for
+Prisma AIRS, and omit unsupported tools. Replacing only `PORTKEY_BASE_URL`
+would send the wrong authentication and some requests to the wrong routes.
 
 ## Recommended coexistence
 
@@ -53,7 +72,9 @@ Use `portkey-admin` for control-plane changes. Use `prisma-airs-security` for th
 
 ## When a direct adapter becomes possible
 
-A native Prisma AIRS mode should be added only after Palo Alto Networks publishes a stable management API for AI Gateway. The adapter will need its own:
+A public management specification is now available. Before shipping a native
+Prisma AIRS mode, verify its published contracts against a credentialed tenant.
+The adapter will need its own:
 
 - base URL and authentication strategy;
 - mapping for tenants, workspaces, guardrails, integrations, and logs;
@@ -67,4 +88,8 @@ That should be a distinct adapter or tool domain, not a silent reinterpretation
 - [Palo Alto Networks completes the Portkey acquisition](https://investors.paloaltonetworks.com/news-releases/news-release-details/palo-alto-networks-completes-acquisition-portkey-secure-ai)
 - [Configure Prisma AIRS AI Gateway](https://docs.paloaltonetworks.com/ai-runtime-security/administration/configure-ai-gateway)
 - [Configure the Prisma AIRS security MCP server](https://docs.paloaltonetworks.com/ai-runtime-security/activation-and-onboarding/prisma-airs-mcp-server-for-centralized-ai-agent-security/configure-mcp-server-security-using-prisma-airs)
+- [Portkey documentation index, linking both specifications](https://portkey.ai/docs/llms.txt)
+- [Prisma AIRS management specification and verification limits](https://github.com/PaloAltoNetworks/openapi)
+- [Prisma AIRS management server declarations](https://github.com/PaloAltoNetworks/openapi/blob/main/_project/servers.yaml)
+- [Prisma AIRS API-key path change](https://github.com/PaloAltoNetworks/openapi/commit/be8e1dc1e893d7034faf2d250973e9f0df1a2784)
 - [Portkey OpenAPI](https://github.com/Portkey-AI/openapi)

package/package.json

@@ -11,8 +11,8 @@
 		"lint": "biome lint .",
 		"format": "biome format --write .",
 		"check": "biome check --write .",
-		"test": "tsx --test tests/config.test.ts tests/security-worker-layout.test.ts tests/security-edge-runtime.test.ts tests/contract.test.ts tests/contract-extended.test.ts tests/unit.test.ts tests/services.test.ts tests/base-services.test.ts tests/fetch.test.ts tests/http-server.test.ts tests/http-edge-runtime.test.ts tests/http-edge-runtime-final.test.ts tests/tools-observability.test.ts tests/tools-catalog.test.ts tests/tools-prompts-configs.test.ts tests/tools-remaining.test.ts tests/tools-edge-workflows.test.ts tests/tools-platform.test.ts tests/tools-keys.test.ts tests/tools-users.test.ts tests/tools-analytics.test.ts tests/current-api.test.ts tests/release-readiness.test.ts tests/lobehub-generator.test.ts tests/auth-clerk.test.ts tests/lib-event-store.test.ts tests/lib-session-mcp.test.ts tests/smoke-outcomes.test.ts",
-		"test:coverage": "tsx --test --experimental-test-coverage --test-coverage-include='src/**/*.ts' --test-coverage-lines=80 $TEST_COVERAGE_REPORTERS tests/config.test.ts tests/security-worker-layout.test.ts tests/security-edge-runtime.test.ts tests/contract.test.ts tests/contract-extended.test.ts tests/unit.test.ts tests/services.test.ts tests/base-services.test.ts tests/fetch.test.ts tests/http-server.test.ts tests/http-edge-runtime.test.ts tests/http-edge-runtime-final.test.ts tests/tools-observability.test.ts tests/tools-catalog.test.ts tests/tools-prompts-configs.test.ts tests/tools-remaining.test.ts tests/tools-edge-workflows.test.ts tests/tools-platform.test.ts tests/tools-keys.test.ts tests/tools-users.test.ts tests/tools-analytics.test.ts tests/current-api.test.ts tests/release-readiness.test.ts tests/lobehub-generator.test.ts tests/auth-clerk.test.ts tests/lib-event-store.test.ts tests/lib-session-mcp.test.ts tests/smoke-outcomes.test.ts",
+		"test": "tsx --test tests/config.test.ts tests/security-worker-layout.test.ts tests/security-edge-runtime.test.ts tests/contract.test.ts tests/contract-extended.test.ts tests/unit.test.ts tests/services.test.ts tests/base-services.test.ts tests/fetch.test.ts tests/http-server.test.ts tests/http-edge-runtime.test.ts tests/http-edge-runtime-final.test.ts tests/tools-observability.test.ts tests/tools-catalog.test.ts tests/tools-prompts-configs.test.ts tests/tools-remaining.test.ts tests/tools-edge-workflows.test.ts tests/tools-platform.test.ts tests/tools-keys.test.ts tests/tools-users.test.ts tests/tools-analytics.test.ts tests/current-api.test.ts tests/tools-governance.test.ts tests/release-readiness.test.ts tests/lobehub-generator.test.ts tests/auth-clerk.test.ts tests/lib-event-store.test.ts tests/lib-session-mcp.test.ts tests/smoke-outcomes.test.ts tests/request-path.test.ts",
+		"test:coverage": "tsx --test --experimental-test-coverage --test-coverage-include='src/**/*.ts' --test-coverage-lines=80 $TEST_COVERAGE_REPORTERS tests/config.test.ts tests/security-worker-layout.test.ts tests/security-edge-runtime.test.ts tests/contract.test.ts tests/contract-extended.test.ts tests/unit.test.ts tests/services.test.ts tests/base-services.test.ts tests/fetch.test.ts tests/http-server.test.ts tests/http-edge-runtime.test.ts tests/http-edge-runtime-final.test.ts tests/tools-observability.test.ts tests/tools-catalog.test.ts tests/tools-prompts-configs.test.ts tests/tools-remaining.test.ts tests/tools-edge-workflows.test.ts tests/tools-platform.test.ts tests/tools-keys.test.ts tests/tools-users.test.ts tests/tools-analytics.test.ts tests/current-api.test.ts tests/tools-governance.test.ts tests/release-readiness.test.ts tests/lobehub-generator.test.ts tests/auth-clerk.test.ts tests/lib-event-store.test.ts tests/lib-session-mcp.test.ts tests/smoke-outcomes.test.ts tests/request-path.test.ts",
 		"test:lobehub-generator": "tsx --test tests/lobehub-generator.test.ts",
 		"test:coverage:qlty": "mkdir -p coverage && TEST_COVERAGE_REPORTERS=\"--test-reporter=lcov --test-reporter-destination=$PWD/coverage/lcov.info --test-reporter=spec --test-reporter-destination=stdout\" npm run test:coverage",
 		"dev": "tsx --watch src/index.ts",
@@ -39,7 +39,7 @@
 	"engines": {
 		"node": ">=24"
 	},
-	"packageManager": "npm@12.1.0",
+	"packageManager": "npm@12.2.0",
 	"files": [
 		"build",
 		"ENDPOINTS.md",
@@ -48,18 +48,18 @@
 		"docs/VERCEL_DEPLOYMENT.md"
 	],
 	"dependencies": {
-		"@modelcontextprotocol/sdk": "^1.31.0",
+		"@modelcontextprotocol/sdk": "^1.32.1",
 		"cors": "^2.8.6",
-		"express": "^5.2.1",
-		"express-rate-limit": "^8.2.1",
+		"express": "^5.3.0",
+		"express-rate-limit": "^8.7.1",
 		"helmet": "^8.3.0",
 		"jose": "^6.2.2",
-		"redis": "^6.1.0",
-		"zod": "^4.6.5"
+		"redis": "^6.3.0",
+		"zod": "^4.6.7"
 	},
 	"name": "portkey-admin-mcp",
 	"mcpName": "io.github.CodesWhat/portkey-admin-mcp",
-	"version": "0.12.2",
+	"version": "0.14.0",
 	"main": "build/index.js",
 	"keywords": [
 		"mcp",
@@ -88,14 +88,14 @@
 		"url": "https://github.com/CodesWhat/portkey-admin-mcp/issues"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "2.5.14",
+		"@biomejs/biome": "2.5.15",
 		"@types/cors": "2.8.19",
 		"@types/express": "5.0.6",
-		"@types/node": "24.13.6",
-		"dotenv": "18.0.4",
+		"@types/node": "24.19.2",
+		"dotenv": "18.0.8",
 		"esbuild": "0.28.2",
-		"knip": "6.38.0",
-		"lefthook": "2.1.14",
+		"knip": "6.41.0",
+		"lefthook": "2.2.2",
 		"tsx": "4.23.15",
 		"typescript": "7.0.2"
 	}